Ledger Nano X (Product): news timeline & CVEs

Who Is Planting Backdoors in Ledger Crypto Wallets?

Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.

Ledger said hardware implants in wallets sold by Malaysian reseller CryptoBilis enabled theft of cryptocurrency now valued at about $102 million from roughly 315 accounts, according to Bitquery. Stolen assets included Bitcoin, Ethereum, and Tron. Users and researchers have also reported implants in Ledger Nano X, Flex, and Stax devices, including two Nano X units purchased in person at MediaMarkt stores in Germany. Joe Grand had notified Ledger of similar Nano X implants in March. Ledger said there is no indication its own infrastructure was compromised and told resellers not to restock returned devices.

Hacker News · securityOct 14, 09:37 UTC · 2d agoData breach in the wild 2 sources HN 128↑ · 155 comments1

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Spy chips in Ledger Nano X wallets sold via CryptoBilis stole seed phrases and over $86 million.

Tibane Labs reported spy chips soldered into Ledger Nano X wallets sold by Southeast Asian reseller CryptoBilis, intercepting on-screen seed phrases and sending them to attackers over a built-in modem and eSIM. Ledger linked the backdoored devices to more than $86 million in stolen crypto and told customers to discard affected wallets and move funds; it paused work with CryptoBilis. Newer implants use a painted flex PCB, and at least one Ledger Flex bought at Singapore Airport was also reported implanted. The same bulletin also covers freezer tampering at French supermarkets including Intermarche, an Ahold Delhaize outage, and a Meta GitHub breach affecting more than 1,500 US employees.

Risky Business NewsOct 14, 03:02 UTC · 3d agoMalware in the wild2· 1 read

Crypto thieves sell hardware wallets with secret eSIM

Tampered Ledger Nano X wallets with hidden LTE modems stole seed phrases, draining about $93 million.

Criminals sold modified Ledger Nano X hardware wallets containing a chip that intercepts seed phrases displayed from the Secure Element, plus an LTE modem, eSIM, and antenna that transmit them. The Secure Element itself was not altered. Blockchain observers identified more than 300 drained wallets totaling about $93 million, with broader loss estimates near $100 million, and some proceeds passed through mixers. Tibane Labs described professionally manufactured implants; Ledger warned customers who bought from Malaysian dealer Cryptobilis in the last three months not to use those devices.

Hacker News · AIOct 13, 08:34 UTC · 3d agoPhishing & fraud in the wild 5 sources HN 110↑ · 2 comments1

Ledger confirms hardware wallet spy implant behind crypto thefts

Ledger confirmed spy implants in CryptoBilis-sold Nano X wallets captured seed phrases and drained users' cryptocurrency.

Ledger confirmed that some hardware wallets sold by Malaysia-based reseller CryptoBilis contained unauthorized spy implants that drained cryptocurrency. Researchers, including Mark Karpelès and Tibane Labs, found Ledger Nano X variants whose implants captured display output and button presses to reconstruct the seed phrase, then sent it over LTE using an eSIM. One design replaced the battery with a smaller cell and an STM32G431KBU6; a more advanced variant fit under the OLED and used a factory flex PCB. Ledger called the affected volume limited, told buyers not to set up those devices or to move funds to a new seed, and said its Genuine Check cannot detect added implants when the Secure Element is intact.

BleepingComputerupdated Oct 13, 08:34 UTC · 3d agofirst Oct 12, 16:27 UTC · 4d agoData breach in the wild 5 sources

Ledger Nano X

Timeline4 articles

Appears with

Who Is Planting Backdoors in Ledger Crypto Wallets?

Risky Bulletin: Spyware chip found in Ledger crypto-wallets

Crypto thieves sell hardware wallets with secret eSIM

Ledger confirms hardware wallet spy implant behind crypto thefts